Most web addresses are all name based on the server side. That is, netadmintools.com and associated logs are monitored and tracked in a different file than requests to the IP address. The first entry in the VirtualHost section of the httpd.conf file for Apache is where the requests without a name go.
Stick a very simple page at this address.
Don’t go putting stuff available here that could be vulnerable. As a general rule, don’t put any PHP stuff here.
Look through the logs at the default address to see what the bot armies are looking for. Here is a compromised machine that is searching for something to invade that hit one of our servers an hour ago:
7 $ grep 1.2.3.4 access_log 1.2.3.4 - - [25/Mar/2006:07:01:12 -0800] "GET /forum/ HTTP/1.1" 404 1178 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; .NET CLR 1.0.3705)" 1.2.3.4 - - [25/Mar/2006:07:01:12 -0800] "GET /phpBB/ HTTP/1.1" 404 1178 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; .NET CLR 1.0.3705)" 1.2.3.4 - - [25/Mar/2006:07:01:12 -0800] "GET / HTTP/1.1" 200 1178 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; .NET CLR 1.0.3705)" 1.2.3.4 - - [25/Mar/2006:07:01:12 -0800] "GET /forums/ HTTP/1.1" 404 1178 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; .NET CLR 1.0.3705)" 1.2.3.4 - - [25/Mar/2006:07:01:12 -0800] "GET /phpbb/ HTTP/1.1" 404 1178 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; .NET CLR 1.0.3705)" 1.2.3.4 - - [25/Mar/2006:07:01:12 -0800] "GET /board/ HTTP/1.1" 404 1178 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; .NET CLR 1.0.3705)" 1.2.3.4 - - [25/Mar/2006:07:01:12 -0800] "GET /boards/ HTTP/1.1" 404 1178 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; .NET CLR 1.0.3705)" 1.2.3.4 - - [25/Mar/2006:07:01:12 -0800] "GET /phpBB2/ HTTP/1.1" 404 1178 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; .NET CLR 1.0.3705)" 1.2.3.4 - - [25/Mar/2006:07:01:13 -0800] "GET /msgboard/ HTTP/1.1" 404 1178 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; .NET CLR 1.0.3705)" 1.2.3.4 - - [25/Mar/2006:07:01:13 -0800] "GET /foros/ HTTP/1.1" 404 1178 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; .NET CLR 1.0.3705)" 1.2.3.4 - - [25/Mar/2006:07:01:13 -0800] "GET /portal/ HTTP/1.1" 404 1178 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; .NET CLR 1.0.3705)" [qtower@main logs]$ |
If you see something besides 404, pay attention, as your site is being watched by a million hosts waiting for a flaw. Remember that to ease installation, some packages will install across your entire web server, so /phpBB2/ will work across all domains including the default.
